Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-08-2023 00:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5.exe
-
Size
2.9MB
-
MD5
a6eb4c8e80d0aa9a82063446027dfb4a
-
SHA1
502c609fc5d32a0e61ce9753c35453d644555260
-
SHA256
6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5
-
SHA512
b5296b9871622ca269396e0cea66df0fad0d25fc8189cf762e77e5a825de3518e573b2b9003698a10ffcbc2310f7ee1a91e1c92843c9bb6e70a22e274d721190
-
SSDEEP
49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTl3kvl5872QvbEw:Q+8X9G3vP3AM6A72QbEw
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2224 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe Token: SeShutdownPrivilege 2224 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe 2224 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5.exe"C:\Users\Admin\AppData\Local\Temp\6ccabcc6aba0484b3a1a023b218dc0f87a77a1f643e9886de3555dbdf3111fb5.exe"1⤵PID:2272
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2224